hero123457/xrdp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request from GHSA-38rw-9ch2-fcxq

Browse Source 
CVE-2022-23483
This commit is contained in:
metalefty 2022-12-09 22:11:40 +09:00 committed by GitHub
commit a1484cd0a1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
xrdp/xrdp_mm.c
View File

@ -676,22 +676,31 @@ xrdp_mm_trans_send_channel_setup(struct xrdp_mm *self, struct trans *trans)
static int
xrdp_mm_trans_process_channel_data(struct xrdp_mm *self, struct stream *s)
{
int size;
int total_size;
unsigned int size;
unsigned int total_size;
int chan_id;
int chan_flags;
int rv;
int rv = 0;
in_uint16_le(s, chan_id);
in_uint16_le(s, chan_flags);
in_uint16_le(s, size);
in_uint32_le(s, total_size);
rv = 0;
if (rv == 0)
if (!s_check_rem_and_log(s, 10, "Reading channel data header"))
{
rv = libxrdp_send_to_channel(self->wm->session, chan_id, s->p, size, total_size,
chan_flags);
rv = 1;
}
else
{
in_uint16_le(s, chan_id);
in_uint16_le(s, chan_flags);
in_uint16_le(s, size);
in_uint32_le(s, total_size);
if (!s_check_rem_and_log(s, size, "Reading channel data data"))
{
rv = 1;
}
else
{
rv = libxrdp_send_to_channel(self->wm->session, chan_id,
s->p, size, total_size, chan_flags);
}
}
return rv;